[jrdld]

Thanks Robert.

So then the second rule really is redundant. This implies that when FW-1 creates automatic NAT rules, the second one will in most cases be redundant, since translated connections are usually only initiated in one direction.

For historical reasons, we have a lot of manual NAT rule pairs as shown above, most of which are for connections initiated only from one end. So if we wanted to cut our NAT rulebases down to size, we could use a single manual NAT rule in most cases, and automatic/reciprocal rules only where we have sessions that are initiated from both ends. Right?

JR